0day.today - Biggest Exploit Database in the World.

Select your language:

Things you should know about 0day.today:

We use one main domain: http://0day.today
Most of the materials is completely FREE
If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD

We accept currencies: [contact admin to find more]

We don't want you to use our site as a tool for hacking purposes, so any kind of action that could affect illegaly other users or websites that you don't have right to access will be banned and your account including your data will be destroyed.

Administration of this site uses the official contacts. Beware of impostors!

We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!

I am registered user of 0day.today. I don't want to see this screen in future.

What to do first?

Read the [ agreement ]
Read the [ Submit ] rules
Visit the [ faq ] page
[ Register ] profile
Get [ GOLD ]
If you want to [ sell ]
If you want to [ buy ]
If you lost [ Account ]
Any questions [ admin@0day.today ]

Main links

You can contact us by

Mail:

mr.inj3ct0r@gmail.com

Facebook:

Inj3ct0rs

Twitter:

Inj3ct0r

Telegram:

We DO NOT use Telegram or any messengers / social networks!

[ authorization ] [ registration ] [ restore account ]

You can contact us by:

Mail:

mr.inj3ct0r@gmail.com

Facebook:

Inj3ct0rs

Twitter:

Inj3ct0r

Telegram:

We DO NOT use Telegram or any messengers / social networks!

ShoprLynx 9.2.3 Insecure File Permissions Vulnerability

Author

LiquidWorm

Risk

[

Security Risk Medium

]

0day-ID

Category

Date add

Platform

ShaprLynx v9.2.3 Insecure File Permissions


Vendor: Lynx Software Pty Ltd.
Product web page: https://www.sharplynx.com
Affected version: 9.02.0003

Summary: Back Office Software for Sharp POS Terminals. Catering for
the needs of retail and hospitality businesses, SharpLynx has been
developed as a modular software solution with options from simple
program management and sales analysis through to multi-location stock
control.

Desc: SharpLynx suffers from an elevation of privileges vulnerability
which can be used by a simple authenticated user that can change the
executable file with a binary of choice. The vulnerability exist due
to the improper permissions, with the 'C' flag (Change) for 'Authenticated
Users' group.

Tested on: Microsoft Windows 7 Professional SP1 (EN)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2018-5456
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5456.php


27.03.2018

--


C:\>cacls "Lynx Software"
C:\Lynx Software BUILTIN\Administrators:(ID)F
                 BUILTIN\Administrators:(OI)(CI)(IO)(ID)F
                 NT AUTHORITY\SYSTEM:(ID)F
                 NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(ID)F
                 BUILTIN\Users:(OI)(CI)(ID)R
                 NT AUTHORITY\Authenticated Users:(ID)C
                 NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(ID)C


C:\Lynx Software\SharpLynx v9>dir *.exe
 Volume in drive C has no label.
 Volume Serial Number is 54D3-A5E6

 Directory of C:\Lynx Software\SharpLynx v9

02/22/2018  02:23 PM           527,840 SL.exe
02/22/2018  02:23 PM         6,747,104 SLE.exe
02/22/2018  02:23 PM         6,747,104 SLED.exe
02/22/2018  02:23 PM         6,747,104 SLER.exe
02/22/2018  02:23 PM         4,932,064 SLU.exe
02/22/2018  02:23 PM         4,932,064 SLUR.exe
07/15/2016  05:58 PM         7,590,288 TeamViewerQS_en.exe
               7 File(s)     38,223,568 bytes
               0 Dir(s)   2,677,899,264 bytes free

C:\Lynx Software\SharpLynx v9>cacls *.exe
C:\Lynx Software\SharpLynx v9\SL.exe BUILTIN\Administrators:(ID)F
                                     NT AUTHORITY\SYSTEM:(ID)F
                                     BUILTIN\Users:(ID)R
                                     NT AUTHORITY\Authenticated Users:(ID)C

C:\Lynx Software\SharpLynx v9\SLE.exe BUILTIN\Administrators:(ID)F
                                      NT AUTHORITY\SYSTEM:(ID)F
                                      BUILTIN\Users:(ID)R
                                      NT AUTHORITY\Authenticated Users:(ID)C

C:\Lynx Software\SharpLynx v9\SLED.exe BUILTIN\Administrators:(ID)F
                                       NT AUTHORITY\SYSTEM:(ID)F
                                       BUILTIN\Users:(ID)R
                                       NT AUTHORITY\Authenticated Users:(ID)C

C:\Lynx Software\SharpLynx v9\SLER.exe BUILTIN\Administrators:(ID)F
                                       NT AUTHORITY\SYSTEM:(ID)F
                                       BUILTIN\Users:(ID)R
                                       NT AUTHORITY\Authenticated Users:(ID)C

C:\Lynx Software\SharpLynx v9\SLU.exe BUILTIN\Administrators:(ID)F
                                      NT AUTHORITY\SYSTEM:(ID)F
                                      BUILTIN\Users:(ID)R
                                      NT AUTHORITY\Authenticated Users:(ID)C

C:\Lynx Software\SharpLynx v9\SLUR.exe BUILTIN\Administrators:(ID)F
                                       NT AUTHORITY\SYSTEM:(ID)F
                                       BUILTIN\Users:(ID)R
                                       NT AUTHORITY\Authenticated Users:(ID)C

C:\Lynx Software\SharpLynx v9\TeamViewerQS_en.exe BUILTIN\Administrators:(ID)F
                                                  NT AUTHORITY\SYSTEM:(ID)F
                                                  BUILTIN\Users:(ID)R
                                                  NT AUTHORITY\Authenticated Use
rs:(ID)C


C:\Lynx Software\SharpLynx v9>icacls SLE.exe
SLE.exe BUILTIN\Administrators:(I)(F)
        NT AUTHORITY\SYSTEM:(I)(F)
        BUILTIN\Users:(I)(RX)
        NT AUTHORITY\Authenticated Users:(I)(M)

Successfully processed 1 files; Failed processing 0 files

#  0day.today [2024-10-06]  #

We DO NOT use Telegram or any messengers / social networks!

Please, beware of scammers!

ShoprLynx 9.2.3 Insecure File Permissions Vulnerability

Report Error

Report Error